A Hacker Has Stolen $10M in Ethereum and No One Knows How | Hacker News Reader

A Hacker Has Stolen $10M in Ethereum and No One Knows How

decrypt.co

37 pointspaulpauper20 comments

Open articleView on HN

If I had to guess, cloud storage compromise or other hack.

or compromised entropy/key generation from older wallets

https://twitter.com/tayvano_/status/1648497998052347905

A lot of the users affected are keys from pre 2018. It's possible that there are bugs that went unnoticed.

I would guess the same .. I know I’ve taken photos of my seed phrases as a sort of hidden but not hidden backup.

Someone probably won the lottery on https://keys.lol

Unlikely. The attack spans multiple wallets

And people win the lottery multiple times in a row.

This is a bit clickbaity. Sure, technically no one knows how yet. But we do in general know how these hacks happen - someone got the private keys. Given that it's the MyCrypto founder that discovered this... it's probably a leak from MyCrypto. Whether it was poor security, some phishing attempt followed by key loggers etc. or just a plain old disgruntled employee stealing the keys, we kind of know how this happened. Good thing that people storing that kind of money spread their cash around and ensured it was all in FDIC insured banks though...

Both MetaMask and MyCrypto are noncustodial wallets, open-sourced under free license. No employees or backend services have access to user keys.

Do Employees have full access to source code. It is autodeployed and autoupdated on remote browsers. One may think that they can remote execute whatever code they want… ?

> "It hit hardware wallets of users who prioritized security, according to Monahan."

it sound like bad news, who would think that hardware wallets would be hacked

maybe people who had their phrase stored in LastPass?

some victims were not using lastpass or cloud, though

No one would guess I'm using password!1234 to protect my wallet, it's so obvious no one would think of it.

Given the stakes, would a reasonable minimum for security involve an ephemeral node, perhaps an HSM, transfer your “digital currency” to a fresh wallet, then offline the fresh keypair to sneakernet, then wipe the node?

The article mentioned that Metamask was involved. How that can be considered a safe way to hold millions of dollars worth of these libertarian digital currencies?

> these libertarian digital currencies?

I know libertarians love crypto, but they also love net neutrality. Calling crypto "libertarian digital currencies" is like calling end to end encryption "libertarian anit-state-surveillance cloaking technology"

I think they mean more a currency with libertarian aspirations, not a currency for libertarians. There is certainly an anti-state, above the law sentiment prominent in the ecosystem.

The politics is divorced from the technology, and I assure you cryptocurrency finds advocates among libertarians, totalitarians, and socialists alike.

The politics is embedded in the technology, you can look to the original bitcoin paper or the genesis block contents.

Bitcoin !== crypto, and there are a lot of blockchains whose founding teams are far from libertarian.

Also, please point me to the places where the white paper espouses libertarianism?

The bitcoin genesis message isn't a direct criticism, and the politics can be interpreted in different ways. One narrative is certainly libertarian-aligned (government shouldn't interfere with businesses and just let market forces drive things). But it's not the only interpretation; for example, there's an argument to be made for a message like: letting banks overextend themselves and then needing to be bailed out is a regulatory failing, and peer-to-peer digital currency offers an alternative to a system that lacks regulation that protects consumers and instead relies on corporate bailouts.

I will concede that the Venn diagram with Bitcoin maximalists and libertarians is significant. But again, Bitcoin !== crypto, and if you look at other blockchains, there's a very wide range of ideologies in the apocrypha.

Exactly, politics is embedded in the crypto ecosystem, where most want to be extragovermental. If you are building something that tries to be money or a security, where people are voting, or is a "token with utility" then you cannot avoid politics being part of it.

E2EE and blockchain/btc/alt are all, indeed, “just math”.

You’ve noted the status quo that is rapidly becoming cemented, albeit in an hn echo chamber presumptuous of a supermajority consensus on E2EE as it may or may not correlate to libertarian ideals vs. state surveillance (i.e. most don’t even have the technical proficiency to vote, thus this assertion is flawed from the start).

This issue is more complex and dynamic, given proliferation of ubiquitous technical surv not monopolized by nation states. Cooperation is the social lubricant of a functioning government, which is often lost on libertarians. Technical libertarians are often the worst offenders of provincial groupthink.

Reply on news.ycombinator.com